A proof-of-concept exploit that achieves RCE against PHP 8.4.26 on Apache prefork/mod_php using only HTTP multipart requests, bypassing ASLR via heap and libphp leak, without session_start() or target-side files.
Useful for
- Reproduce the RCE chain in a local Docker lab from the official php:8.4.26-apache image
- Study heap leak and libphp base disclosure techniques via malformed multipart POST
- Verify your PHP deployment's exposure to this session/ASLR bypass scenario
Before using
- No license is listed in the GitHub data; check the usage terms
- Installation and requirements have not been verified; review the README before running
Why now
- Created on GitHub
- 2026-10-21 UTC
- First seen by GitNova
- 2026-10-21 UTC
- Magnitude
- 8.2 / 10 · growing interest
Not enough consecutive complete history days to compare daily gains
Measured: October 22, 2026, 12:21 UTC
Measurement details
- Created on GitHub: 2026-10-21; first seen by GitNova: 2026-10-21 (UTC)
- +385 stars measured 2026-10-22, 00:37–12:08 UTC
- Not enough consecutive complete history days to compare daily gains
- Magnitude 8.2/10